#
Sweden implements the new EU Consumer Credit Directive (CCD2) via a new Consumer Credit Act (lagen 2026:1011) and new licensing rules in Chapter 3a of the Act on business with housing credit and certain other consumer credits, in force from 20 November 2026. These extend Finansinspektionen authorisation requirements to firms offering deferred-payment/BNPL-style consumer credit as an ancillary activity, with carve-outs for smaller firms and interest-free invoice credit repayable within set periods.
The defining development this cycle is the confirmed entry into force, on 1 March 2026, of the Act on Criminal Liability for Unlawful Financial Activities (2026:56), which criminalises conducting financial activities without required authorisation or registration. Penalties run up to two years' imprisonment for the base offence and from six months to six years for aggravated offences. This corrects a baseline research finding that had characterised the measure as a still-pending bill with only a proposed 1 March 2026 in-force date; the Act has since passed the Riksdag and its in-force status is now confirmed. The change raises the stakes of the unauthorised-activity/market-access boundary from a purely administrative matter to one of criminal jurisdiction, materially increasing legal risk for unlicensed operators and the facilitators around them.
FI's enforcement of the licensing perimeter is active in parallel with the new criminal-liability framework: the regulator withdrew the payment institution authorisation of Get betal AB on 21 January 2026 after the firm provided inaccurate information in its authorisation application, with the withdrawal taking immediate effect. The case is a relevant precedent for peer PI/EMI applicants regarding the consequences of application-stage misstatement.
Outlook
With Act 2026:56 now in force and FI continuing to withdraw authorisations for application-stage failures, the Swedish licensing perimeter is tightening on two fronts simultaneously — criminal-law exposure for unauthorised activity and administrative enforcement against authorised firms found to have misrepresented themselves at entry. New PI/EMI applicants should expect continued scrutiny of application accuracy, and unlicensed operators now face materially higher legal exposure than the pre-March-2026 baseline.
Licensing, Authorisation & Market Access
Sweden has introduced a new authorisation requirement for deferred-payment credit under a new Chapter 3a of the Act on business with housing credit and certain other consumer credits, giving effect to the EUs second Consumer Credit Directive through the domestic Consumer Credit Act. The regime, which takes effect on 20 November 2026, requires firms that offer credit-granting or intermediation as an activity ancillary to their main business, including buy-now-pay-later-style deferred payment arrangements, to obtain authorisation from Finansinspektionen. This closes a supervisory gap that had previously allowed non-financial firms, including many point-of-sale BNPL providers, to extend consumer credit without being brought within FIs authorisation perimeter.
The regime is structured with two significant carve-outs. First, firms already holding authorisation as credit institutions, payment institutions, e-money institutions or housing-credit institutions are exempt from the new Chapter 3a requirement, since their existing licences already cover the relevant activity. Second, an exemption applies to interest- and fee-free invoice credit repayable within 50 days, or within 14 days where a large online seller does not sell the underlying receivable onward to a third party; this preserves the ability of retailers to offer short, cost-free payment terms without triggering a credit-licensing obligation. Firms that fall outside both exemptions and are already conducting now-licensable activity as of the 20 November 2026 effective date benefit from transitional relief, allowing them to continue operating without a licence until 20 November 2027, a full year after the regime takes effect.
The structural significance of this change is that it extends FIs authorisation perimeter specifically to firms whose core business model is not lending but who extend credit as part of a broader commercial offering, a category that BNPL providers in the Nordic market exemplify. Firms operating in this space will need to assess, during the one-year transitional period, whether their existing exemption pathways (invoice credit, fee-free short-term terms) continue to apply to their specific product structures, or whether they now require full FI authorisation. The length of the transitional window, a full year, suggests the Swedish legislature intended to give the market a genuine opportunity to restructure rather than face an abrupt compliance cliff.
Outlook
The period between now and 20 November 2026 is likely to see affected firms assessing whether their product terms fall within the fee-free or short-tenor exemptions, and those that do not will need to begin the FI authorisation process well within the one-year transitional window that follows. Given the one-year runway, the more informative signal will likely emerge closer to mid-2027, when it becomes clearer how many deferred-payment providers have actually obtained authorisation versus restructured their products to fit an exemption, versus exited the Swedish market altogether. Whether FI issues interpretive guidance narrowing the ambiguity around what counts as credit-granting as an ancillary (rather than main) business activity is also a marker worth watching in the near term, since that boundary will determine how broadly the new perimeter is actually applied in practice.
3 earlier distinct update(s)
Licensing, Authorisation & Market Access
The Riksbank's RBFS 2025:1 regulation on reporting payment statistics entered into force and began to apply on 1 October 2026. The regulation requires payment service providers and payment system operators domiciled in Sweden, and foreign payment service providers operating through a Swedish branch, to report payment statistics to the Riksbank. Account-information-only service providers are excluded from scope, a distinction that matters for firms whose Swedish activity is limited to account-aggregation services without payment initiation or execution. The regulation's credit-transfer reporting limb, the component covering the reporting of credit-transfer transaction data specifically, has been deferred to 1 October 2027, a full year after the main commencement date, giving affected institutions additional time to build the specific reporting pipeline that limb requires rather than demanding it alongside the general 1 October 2026 start date. This phased approach suggests the Riksbank judged the credit-transfer reporting requirement to carry a materially higher implementation burden than the rest of the regulation's scope, and chose to sequence the obligation accordingly rather than impose it all at once.
The regulation applies to both bank and non-bank payment service providers and operators falling within its domiciliary and branch-presence tests, with no indication in the evidence reviewed that the reporting obligation itself differs materially between bank and non-bank entities once a firm is in scope; the distinction that matters here is domicile and branch presence, not entity type.
Outlook
The operative date to track is 1 October 2027, when the credit-transfer reporting limb of RBFS 2025:1 becomes applicable, converting what is currently a partial reporting obligation into the full scope the regulation originally contemplated. Firms newly establishing a Swedish branch presence or Swedish domicile between now and that date should expect to be brought into the full reporting scope on the later date rather than the earlier one if the credit-transfer-specific build is not yet operational.
Licensing, Authorisation & Market Access
The EU-level licensing framework governing payments market access is advancing toward formal adoption. The Council of the EU's Committee of Permanent Representatives has been invited, per an 'I' Item Note dated 17 April 2026, to approve final compromise texts for PSD3 and the directly-applicable Payment Services Regulation. Once adopted, existing e-money institutions will need to seek reauthorisation as payment institutions rather than continuing under their current e-money licence, a distinction that matters directly for the bank-PSP versus non-bank payment-institution/e-money-institution split that defines this module's practical scope. Formal adoption is expected in 2026, with an 18-24 month transition period before the current PSD2/EMD2 framework is repealed entirely. This is assessed at probable confidence, sourced from a legal-tracker analysis rather than the Council text directly.
For Sweden specifically, the practical effect of this EU-level development is a forthcoming reauthorisation exercise for any Sweden-domiciled or Sweden-serving e-money institution once the transition period begins, layered on top of the domestic developments already reshaping the market-access landscape this cycle -- notably Getswish AB's move to clearing-company status, which itself represents a market-access-relevant supervisory upgrade for a non-bank payment scheme operator.
Outlook
The formal Council and Parliament adoption timeline for PSD3/PSR through the remainder of 2026 is the item to track, as it will fix the exact start of the 18-24 month reauthorisation transition window for e-money institutions operating in or into Sweden. Firms currently operating under EMD2-derived e-money licences should treat this as a defined, dated compliance project rather than a distant possibility.
Licensing, Authorisation & Market Access
Sweden's licensing landscape moved on two distinct axes this cycle. At the prudential-formalisation end, Getswish AB, operator of the Swish instant-payment app, was granted a clearing-company licence, placing Swish under direct Finansinspektionen supervision for the first time, a first-of-kind milestone for the jurisdiction's dominant instant-payment operator (high confidence). At the enforcement end, Finansinspektionen withdrew the payment-institution authorisation of Get betal AB, effective 21 January 2026, for inaccurate application information, an enforcement-driven withdrawal rather than a routine market exit (high confidence). Read together, these two events illustrate the bank-PSP versus non-bank PI/EMI distinction that structures this module: Getswish, a non-bank payment operator, gains a heavier prudential licence category, while Get betal, also a non-bank payment institution, loses its authorisation outright.
At the supranational level, the PSD3 text and the directly-applicable Payment Services Regulation were put before national representatives for approval on 22 April 2026. Together they repeal and replace PSD2 and EMD2, folding electronic-money institutions into a re-authorised payment-institution sub-category and eliminating the standalone EMI regime EU-wide, including in Sweden, once formally adopted (assessed confidence). The Payment Services Regulation enters into force 20 days after publication and becomes applicable 21 months later, with territorial scope covering payment services provided within the EU (assessed confidence). This sets the future national-transposition and re-authorisation clock for Sweden's non-bank payment sector, though the precise date remains contingent on formal adoption.
Outlook
Watch for formal adoption of PSD3 and the Payment Services Regulation, which would start the 21-month applicability clock and determine when Sweden's standalone EMI licence category is folded into the re-authorised payment-institution sub-category. Watch also for whether other non-bank payment institutions face authorisation scrutiny of the kind applied to Get betal, and for further prudential-formalisation moves affecting other large non-bank payment operators following the Getswish clearing-company precedent.
Sources and findings (6)
- T1https://www.fi.se/en/payments/apply-for-authorisation/payment-services/retrieved
- T1https://www.fi.se/en/payments/apply-for-authorisation/electronic-money/retrieved
- T1https://practiceguides.chambers.com/practice-guides/financial-services-regulation-2025/swedenretrieved
- T3https://ifbusiness.uk/how-to-obtain-an-emi-license-in-sweden-2025-requirements-costs-advantages/retrieved
- T2https://sweden.dlapiper.com/en/news/swedish-government-proposes-criminalisation-unauthorised-financial-activitiesretrieved
- T1https://www.fi.se/en/published/sanctions/financial-firms/retrieved